Analysis
-
max time kernel
111s -
max time network
157s -
platform
android_x64 -
resource
android-x64-20240624-en -
resource tags
androidarch:x64arch:x86image:android-x64-20240624-enlocale:en-usos:android-10-x64system -
submitted
08-09-2024 15:29
Behavioral task
behavioral1
Sample
d4aca9745b1df836541488f9ba87381e_JaffaCakes118.apk
Resource
android-x86-arm-20240910-en
Behavioral task
behavioral2
Sample
d4aca9745b1df836541488f9ba87381e_JaffaCakes118.apk
Resource
android-x64-20240624-en
Behavioral task
behavioral3
Sample
d4aca9745b1df836541488f9ba87381e_JaffaCakes118.apk
Resource
android-x64-arm64-20240624-en
General
-
Target
d4aca9745b1df836541488f9ba87381e_JaffaCakes118.apk
-
Size
17.7MB
-
MD5
d4aca9745b1df836541488f9ba87381e
-
SHA1
9d2430f0cba9aa83b00c4607e2bc2cd91c9a2158
-
SHA256
5bc8e6f99911ef55bd375a08f2023d62c2a3a29d10aeb7938fb843d9074b691b
-
SHA512
2b5b9864472c5c672b39b9c73c59e90c66bc06a97187ebd682deb830d9d8f21bcf440e1c3d1fe3ffe8202e796ecbb1f564ad7967055a1bbeaeb0ce0ad071e620
-
SSDEEP
393216:lRkM6oA9/wSg90/JJlGKI3QV8D3r13bxsrXIJoJl/AqaIv+EC3I0JAus0L+BQDQg:lt6/ng9OHlGKI3QV8jr1rxWYyboqHq3F
Malware Config
Signatures
-
Requests cell location 2 TTPs 1 IoCs
Uses Android APIs to to get current cell location.
Processes:
ir.ghazae.mahale.gelan.ddescription ioc Process Framework service call com.android.internal.telephony.ITelephony.getCellLocation ir.ghazae.mahale.gelan.d -
Acquires the wake lock 1 IoCs
Processes:
ir.ghazae.mahale.gelan.ddescription ioc Process Framework service call android.os.IPowerManager.acquireWakeLock ir.ghazae.mahale.gelan.d -
Queries information about active data network 1 TTPs 1 IoCs
Processes:
ir.ghazae.mahale.gelan.ddescription ioc Process Framework service call android.net.IConnectivityManager.getActiveNetworkInfo ir.ghazae.mahale.gelan.d -
Queries the unique device ID (IMEI, MEID, IMSI) 1 TTPs
-
Reads information about phone network operator. 1 TTPs
-
Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
Processes:
ir.ghazae.mahale.gelan.ddescription ioc Process Framework service call android.app.IActivityManager.registerReceiver ir.ghazae.mahale.gelan.d -
Schedules tasks to execute at a specified time 1 TTPs 1 IoCs
Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.
Processes:
ir.ghazae.mahale.gelan.ddescription ioc Process Framework service call android.app.job.IJobScheduler.schedule ir.ghazae.mahale.gelan.d -
Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
Processes:
ir.ghazae.mahale.gelan.ddescription ioc Process Framework API call javax.crypto.Cipher.doFinal ir.ghazae.mahale.gelan.d
Processes
-
ir.ghazae.mahale.gelan.d1⤵
- Requests cell location
- Acquires the wake lock
- Queries information about active data network
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Schedules tasks to execute at a specified time
- Uses Crypto APIs (Might try to encrypt user data)
PID:5039
Network
MITRE ATT&CK Mobile v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
/data/data/ir.ghazae.mahale.gelan.d/app_com_birbit_jobqueue_jobs/files_jobs_default_job_manager/749fabb7-792e-45a5-990d-e4a345aa1048.jobs
Filesize991B
MD5136b24e7d531af138e718d306bdea435
SHA1bc97ffbb44f0e52abe33eac7094418a722818c77
SHA2566b627171ec9e6c136e3fdf52f185993f054f46672221b872df5ab3699bc08e5a
SHA51235b0cb1b7482761e8e8ec2e2dc3ec1d203e29e80d6e55b9787ec991e11bcaefc313e739497db4421e071029987adb86a288395449d2a9edf122e3f405018074f
-
/data/data/ir.ghazae.mahale.gelan.d/app_com_birbit_jobqueue_jobs/files_jobs_default_job_manager/ac893696-5d32-4ad9-9e8c-cc91729d32e7.jobs
Filesize811B
MD5b1c236ff7d4843b08dd25ee7605428c4
SHA1ec219656a4424b78c3651aaff0f4eb30c9739304
SHA2561a7c459f64562c2af5b6739159090dc1aba41bf19eacc8730eb77796974398cc
SHA512680505288e3ffb86c0cdc898ee2132e41805cfc55782e60d27f8101653a143e7c1c61cd9340d90dceb710edec634fbc01d9d8277d096c1ffae1aa3dc6e96fe40
-
/data/data/ir.ghazae.mahale.gelan.d/app_com_birbit_jobqueue_jobs/files_jobs_default_job_manager/ade68770-56eb-41a7-8ffb-8c66a4565613.jobs
Filesize176B
MD5f56f328eea1d5c96a1b96dbbf59488df
SHA1440c784cacff61932e2f61580b7cfdc3a4943c95
SHA25690949c83a3d90fc0128f0d5df662aef3699971ce9e63ab067382f970cbab8918
SHA51236e370cf16dac8b173fa182960789974d4087a7b607042000118ce518db8f1eaf93cf4f3be42c1c26ab53e87ff54da33b4c57a3a15e5cd47f2c2b66efe8b3edb
-
/data/data/ir.ghazae.mahale.gelan.d/app_com_birbit_jobqueue_jobs/files_jobs_default_job_manager/c016ed27-c0de-4e80-8fd7-f24e3bd5f89c.jobs
Filesize278B
MD510a1139569e3e04b71881f248b8affc4
SHA12a60e30f39676f3a41cde9ae84f72be86ebfbb85
SHA256e53e34e008a9945417682e69aa02f94be8ea87ef4c06298c5a4fcc04b72011f9
SHA512c25b86c302726115a56ee31f7fb2162ed3b4ca0cc3814aacb59cb7fa383956f24fd1185fb20387b41c44b12aaa3af3ce97b335ef0e410eb9e5777d741872ee00
-
/data/data/ir.ghazae.mahale.gelan.d/app_com_birbit_jobqueue_jobs/files_jobs_default_job_manager/d2c5d63e-faff-4c72-b402-95ab0a5caf6f.jobs
Filesize179B
MD5ac58f99a1b179d71e8621412ad31c6a1
SHA1b51fdad95876f5615735c2ab411031ff67d5e946
SHA2569537553772c29c4303e606e458fd9598c14f1eee3cadfb446e241638bee3ccdb
SHA512faf45d5eb4b890216e6ad33825ffc02cbc57914628e625164f9cbdacd5962ce8ca8f473ded2f56eb4d4006fc7cafa9cff8c9f76655f17f83f38d3e89b8d7e67b
-
Filesize
24KB
MD5d9d3a377c3b6f62543327884f3cb46f9
SHA1741bec73b4160db48f17995c0be34a783cf9d314
SHA256829e6a5383ecc2b9fad64636b8361c0eb9f995bd218df144502bbd4946056f75
SHA51263fb8de2044836c51218c6d98f64ab3335e5310b2ddb0f5e114a99e6d29ba6058340f1373ab9764fbbd709e0525db40b42782dda5b855815a9e09118a656e829
-
Filesize
512B
MD5d7178526a71289ac526933a486ff1167
SHA1c77bcd160b4eb87a555bcebe4cba98bcfd063cbf
SHA256da3f42e089c728a399f42ceec7dcc0f4f5bf82e9e255bf1926c1a538e775b98f
SHA5123e103bcddc65669206c6d2c76e1b859eee86a4392fc18999809f524801666266e558de11e3ee4f4849eba2433cab4e8bd5131313a556a8237b0200eda4529888
-
Filesize
8KB
MD55cc37e4a52dce4682017e0c1e839b8e1
SHA110a082f40a6b0773b17136de97bb891b4b224885
SHA256c3c43dca57d113954e69f6bccc5048c9a5b84dee5f96e91ede50bb1899265031
SHA5126cf7af5d1dad42a345dd06d56c8bfdae1d3d58fbc778e647d787b6ce2ea818133053e26ba6ad649dd6550e23c59b835aca0e66c31671a8e95bd5d6b84d203984
-
Filesize
8KB
MD57a06209f85da9a9ca7f0ff7659307931
SHA1475ff4745be555556e2f1a574e3cc628255d7cf5
SHA256fd256f33a129dd76a781fc8d13cd621563e578fc90b02970bcace5fc1c808d28
SHA51274692ebf2f133515073df6a3683d2a7ed9d2e0b8117fe21d3256417db075d29da10173f414ad02ec6768acb1991bad1dad652ab8b8d1bc4b766e73c2b3b7acfe
-
Filesize
8KB
MD51b19becc36e6241604752f4b72863adb
SHA168b631d0031ff8f6c793f1c41a02134ed7abd35a
SHA25645734fc0621bba022ba45dc34c2964d51a28fce5b6472efa8bb90a35a04fb15e
SHA512d1e5a70caca8ff729326dfc808fb03979b175b3334a206c62f4de0df5c0915f652894308869f06a2ce75257d214abb1ba154dfd217fb8b9d0f454f528e7f1106
-
Filesize
8KB
MD5d3dcc444a383f76b0356fff81e57925e
SHA1bae02263ee833b4b9a2586a3e3555e30163f7a5d
SHA256c5e6fbacf1043aa0972557c8fa2722aa1c77c031b0288e104fa3d34f4f5022cc
SHA51267849c344078830c8e1de429192d1142b32d21e6a01a5aac0c861b4a90f810aeaded4e89e4767339b7a7bfb21bff4a1c69f304bd915e0df36429042db304ce28
-
Filesize
8KB
MD5902625aaedfda157a22e4ac111e98d1e
SHA147e5b7a156c2f132bfe41fba0b1d653430b8b938
SHA256f22922ae946861bba5a4a288b8e0dfaaf889de05a3d5608b01f59e222cb0d552
SHA512bc7e77b8ae870ae1e4831c6c73286854bc3e25c30ab21d4ca9c7bdb5aef92e13453633fede70d84697cfb56995096cfa5eaef257358ed40b5ba221ac7490ba4f
-
Filesize
20KB
MD59106c7207cbca8814eb347530f559312
SHA1e775ee96aeada25ea228e17e00eb7689cefe77d1
SHA2567a4cc1011ce6e71bb6fb62340ee832349ccba912d948729b674a2bf09ce6b551
SHA512ffd44b5743ee4ffce76a1b8b17dde8c35248ed7404a7560f49c2419922cc2f1e259ce3b43d0d64b4079bd26860eeb7ed1348a847b3aa9c47dee19ef0c3ab1e0d
-
Filesize
20KB
MD590c074e7c120225736ef713a5f86ffaf
SHA10f3c4ad33307da829d448bcc9a2f3517f2a98071
SHA25630f6ffe3680c77a44b5820fd837c1f4aa1741125f96a66742ab60055cc24a924
SHA5126fafb600420693b286e72479c714c7fee7ebbc4b67c33d28a94da4d0e8e581211812d3af428b207d2293888969b2551ad1a4fedff25ad2476022052f4f7ca28b
-
Filesize
24KB
MD5259a1e4e7ebc4b0d0341ffcf0c3bc2ea
SHA19b8da5a0b24833a3e84567d9d8ee0d2f54d7b48c
SHA2564f4987ac3d84abad3490459fa7a32b7bfadaae5f329e15dcff36e07d34faaeb1
SHA512dc1296e2b0b18dd83a3782acb700e155ea9a60ef193bfa8c98999e7cc3c5b73a97c20a974cc956ab438aeeba812ec2d2f401fb2e714bb9bb5fb421fa4b7a2313
-
Filesize
512B
MD5e9e27e4419af47e77300310a1647427d
SHA1efd71098ae97d4f209754361a0d65bbd30e99f10
SHA25611e3056659d6d115daf45392a50d44f5318f10977825ff6c0df5172ba7ecb006
SHA5123ad09698b63fb25967c0a6e95818a2de5c6a068062523acef8302af366dee0f99291bc0764a589a7ba6a4c27c212ebce8c1d5f5f92826060321bf84faecd2db1
-
Filesize
8KB
MD5d1460eb153a903b1677ff25fefeb6f70
SHA104490d21a355b4adc558839383740ce20a77dc01
SHA25637fc743f4dd90b02af6249a9a38c0539818d698a27903306aba0850b0e5bedca
SHA512b4ddada96916ce7e5fa577df18a55d854a5fd9ec54f4817de964e1c242616f31a47b27e10f307704d5e60260d42842a04bb85cb412ee0d0aae76f7ff88a25ec5
-
Filesize
8KB
MD562883f7dc58a5c927666061cfecf53da
SHA159342ffbe1d6274419b19ccf05a250a8f5fd3176
SHA25609376117d56c33760ab046f3b00bf417eaa64a49598f1d9f9e3f2d5eca7393e7
SHA5127824bb6feef781112987e3e4e21045b6b8b76e4cc3e4123e5f388d497cb98180840557bb8b8bc901799a120f1dee6d86975dfd1089679bd399968045e89af330
-
Filesize
8KB
MD598676b3b09944e695d5c32e4c5372394
SHA183588daf789871d96d6d4ad92ec564bc57fdba77
SHA256e5ce46d98a2ddcfc7e6daa7d222b83c4cf0b9fe587423460543ca9ca5b0939ed
SHA51280a12119f732007f86bcdb2a0a2db9eff4a53a6c8ac4718a3b8b843a039684f86a8695be77fb072e3f8a02df3ed2cde96ce3f68a031ba8ff5bd93b47e58f7473
-
Filesize
12KB
MD5cfc6b49837c00925cd24bd6e295c040f
SHA17bdc5edf00e86dd7ed47f23f1de6bb8bba92460f
SHA2569cddcfd87ce68c93718d1355cc79a64dcc93e1477e42f71a73c323dec42ca4a4
SHA512fdb9e458da5b04940fbed46f7d8465474b6fa58a4182ba97028cd63f053f5e19cf4a13338b40a0b2f69d9b580ce3040a5d6bbe736a36d4e971198b4f554e189f
-
Filesize
12KB
MD5f61e5caf264f02bfd4280978423171cf
SHA19e4f273864db85c64a12bca927a87ca31c2f1f80
SHA25609bd2865a024cd93d24eab960cf2ed3eba457a59d26ebe7e7b75621378be8046
SHA512a975225df7ba0b8457868c0721d1bfd9a6b46527715480a93857b63eb41830cbab2f18e709c84350945b0cf40306a2bb55348d30db1daf27339572e3f4db11a1
-
Filesize
28KB
MD552f3999ab329a3b4b8f6033fa80f3609
SHA170de17b7beae1f338770620e9b7cc232f4bab4e5
SHA256cf82b6758bdd872525eac2c0060886978fe8560b170a4139dd782dec03c439c1
SHA5122defb8035efc52ace0903a8d00ce8f70e0e54a33cbcb9f5bd855718e721b3415ec1f6cf2e639d2b943f5451428ca70be14f8a6e8cc08ce8a46a7464bb950ab86
-
Filesize
20KB
MD597f18f5d2b137651d9dc446174de28a4
SHA1d4b2c1574af2675fd550b5fa2031bca0797eb535
SHA2566cbe45d40957ea36449dc4d82f84f7e4ea6b2c3e04f33c8d6ae00b75505f1f06
SHA5127a4bd48a18f374b953c506ab1f4ff831014f231084693bb728d7997e687e469b2a30f7fbb1a5ff4d9daf8214a0ee33edfb912c02831bfc1d4592370750cf01f5
-
Filesize
512B
MD5cc06e02d3f90232bbe9590f2f76c31d9
SHA17ddd0fde692ca007400ae494ffa5c17bb05d2475
SHA256a82578755df093757cc9cc5a4187064192abc46dee79c3a618942d0e54a69d70
SHA5123be9c6f39563949dea130f693a0074d6a32e8d10586d641e7e3b07d4ff27f466e9a0915129cd7c39f27d0274487d857a2c5dd33479dc9ad4a0412858d363d3f4
-
Filesize
8KB
MD591bba2bb23c2777ff0734c648bdc7e14
SHA16d4cfe66ebd3e8120fdaca30d81e3f2e10c0e340
SHA2562fcb4b206571586f7f4d23683a1b590cb49ad80861bd60623dc37b01ed6ee44f
SHA5125a1c835a56a9c83b0020932a8901c29e09774be00d243fee9f7ec19bb4118268408b0f5fc604a69987008118f5e66eaac82253d12f61c8317252064f330b38ed
-
Filesize
8KB
MD5fbb06b23db9fcef328043e3960d21dd4
SHA14e15a54d31957bdc3c827d0a3cd0bb009433e9c2
SHA256a1f4ca27b596ca93449941f3d0e8796e877acc72924a7a3458ecc0c662d3fe78
SHA51285df4381dd50624116885ee18823c61625c8f3ba61dbd437b9787d8a25b8aed20a2123da4dcff92d2267dbd4c7e753667c34abd737a774b0c2b98b7e49bcf1d2
-
Filesize
12KB
MD502ad7ab9efa98b99da905118eab411eb
SHA1a1fd5f1c3045e5f6eb57db8504f10480551a9582
SHA256e843e9a37b0f0bd9961e97722a6b88776d88eff5b2d2419b6ff5c0f1eff22787
SHA5129549473e3ecc26ab4558251a68a696fb8fb4e5a2de1d0fd628c90838e85e7587557e76f5b0f67eb0bb91566da7c7f5bdbe5dffe41997f239fb55bdb7dccb2d9b
-
Filesize
20KB
MD527e44406982cf0a03d8baff23b7423aa
SHA1d461cfe010b1ab7d7fc3641557d3d87b5f127a9d
SHA25675f476e9dbff1738156df4089addce5b5db60368e951fa2cff1b0270d053e61a
SHA512c41d77e416a114439a380107e839c06cbb0555e0879ef5ca2fcdfa405a48688202327cfff3c41cd8362886bceb864d78de75aa3cce5d99bf0a25e82400a67cce
-
Filesize
16KB
MD5b9e703c8e84b92a150902542f6173820
SHA171c83cb6bef75ade59b1c98c3377b429319d6876
SHA2569c7be3f134e1ee00269f8640f1a4cacd841f49f2e497235a8188168fbecdcece
SHA5127e1517539321a188d728acb537b17f8ce4e13ddfa09e6392012566aebd77e518ebd4429429ecc488b6084419d5517b8399f12f18e23d042fdeefb9a6778604e0
-
Filesize
512B
MD5976d1069ced50840a1edcc1f2b8f60a2
SHA10f6d9281788d88d0ce1f3aa189b8c775e56f0f7e
SHA2568f9337b82ba18414973a7576a0b1fcbf54b33a845a2ae94021021c9d531ac1c8
SHA51241aa23b0aee161b1ab59ff79babc193f8d6a4a2a612195a8e9ee58397b4f92ce49aef3c6519cb7622b88c50b986728a9fc47f0f51241f94ce49c25dd3aaeb619
-
Filesize
8KB
MD5cf24b1ba0688be16a5c373e81415a8ad
SHA1155cf3e9ae057bfa4bc5890041cfa4007246f9a4
SHA256e27f860f5e3983cec76c5880222bd2d9a099236c61d57d47246f1574a58fcbb1
SHA512fb60bb01556c7da3cf6c257e5aebe12c0a14e2bf78aaff16bd750d31ef935477e51b50c7e8d17e5f9cb324a5433d8515c096553c8ce29fc798a4ddb870e97c1a
-
Filesize
8KB
MD5ca5e3f678a6e812072ba173569066342
SHA128c84723c2e74be1f3923efa0ee3d3c9d1ac9c8d
SHA2562a4107866f5d18be8aca8dd05dc8af4aaad64d30c2a5dc734dc0d718cef4f55f
SHA5124c107dfe2418335fbe3af89b23356d00d7ff4addadc8f25c05d80a6b21f939de978f362837c5ef70a8f9c1366bb86242c3434cdf21d1ea82a504f5e3af83d3ce
-
Filesize
8KB
MD519605f2258cd6f0454a788d0cfd27b4d
SHA14a8486a216aef333c474ccc4e2542c051621c181
SHA2561371a098c51d747f529c8f242fb2489d14f4578848b7374e048074f03b7e4624
SHA51280f5fc49c692ad2d17c467443c2a114186c4b374d2dd8677524042796c79fceff295b3d0618a92ef28f66ed34605cc0f46437cdc727250a32adad0ba26a371ad
-
Filesize
8KB
MD5b92246cf525493613eeab17c904e42bb
SHA19c94d44b21f826d54d7a99c5dccb2b2b71d3c827
SHA256de59bfb977dd139ed81138f2308c2472e56500c1dfe71d0c0483a5b367138102
SHA512ced47f699e81510e0c70e18ad875749a5c415cf995ec235dac2ecb79019fd631ce4ab9cafaa05e6270c1b932facbd370b5283dd0d9fcefa97d9d49f6a5eebe44
-
Filesize
8KB
MD576315f43641546bb3205461f7e271207
SHA174e490f62da68c75216dfbea847baec993798ebc
SHA2566c0b75291a87d1c4ae3ce8cd4b9ad6aae0be87f7765962cc76fa577d307c4f26
SHA51273f31d28c3fa7a92c061f6bc4060fdbb4fe5ea3ed5a03d05ccd097b2d4ff96c8f2cedd9a1030114e47fbd7e223ca9b67a29de6f41f373a54f4b0969dd4bd4179
-
Filesize
2KB
MD54db291cf252513be94bb9c90cf7aa0f8
SHA15fa87975eeee39d2df66c9d51f6b8da4e83d734d
SHA256cd4dc876d031b6fe1a99e95cbc646516d44031d8d336c513c9b164c18f4a8d67
SHA5125938970f89b792e6b96c5696053fdf40fe27cb1fa46bd3ffa7c5666d73dd865b591a2c7b01b12983067e9d6a581ec8de3b6ddf9f6f124de42d50c29fdf9e4a99